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CLAIM LISTING 

This listing of claims will replace all prior versions, and listings of claims in the 
application: 

IN THE CLAIMS 

1 . (canceled) 

2. (currently amended) A method of protecting a design for configuring a PLD 
comprising the steps of: 

loading an encrypted bitstream representing the design into the PLD; 
decrypting the bitstream in the PLD to produce an unencrypted bitstream 
representing the design; 

configuring the PLD with the unencrypted bitstream; and 

disabling partial reconfiguration of t he PLD from bo i ng part i a ll y roconf i gurod . 

3. (currently amended) The method of Claim 2 wherein the step of disabling 
partial reconfiguration of the PLD from bo i ng part i a ll y roconf i gurod also prevents 
part of a user's design from being relocated to another part of the PLD. 

4. (previously presented) The method of claim 2, further comprising disabling 
readback of configuration data from the PLD after configuring the PLD with the 
unencrypted bitstream. 

5. (previously presented) The method of claim 4, further comprising: 

loading decryption keys into the PLD; 

disabling the readback of the configuration data in response to a first state 
of a security status signal indicating that the decryption keys are protected; and 

enabling the readback of the configuration data in response to a second 
state of the security status signal indicating that the decryption keys are 
unprotected. 
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6. (previously presented) The method of claim 5, further comprising: 

establishing the security status signal in the first state prior to loading the 
decryption keys into the PLD; and 

establishing security status signal in the second state after loading the 
decryption keys into the PLD and before the loading of the encrypted bitstream. 

7. (previously presented) The method of claim 2, wherein the configuration 
bitstream includes encrypted configuration data and encrypted configuration 
memory addresses. 

8. (currently amended) An apparatus for protecting a design for configuring a 
PLD, comprising: 

means for loading an encrypted bitstream representing the design into the 

PLD; 

means for decrypting the bitstream in the PLD to produce an unencrypted 

bitstream representing the design; 

means for configuring the PLD with the unencrypted bitstream; and 
means for disabling partial reconfiguration of t he PLD from boing part i a ll y 

reconf i gured . 

9. (withdrawn) A method for configuring a programmable logic device (PLD), 
comprising: 

storing a plurality of decryption keys in storage elements of the PLD; 

receiving a configuration bitstream at the PLD, wherein the configuration 
bitstream includes control data and configuration data and at least the 
configuration data is encrypted; 

decrypting the configuration bitstream in the PLD using the plurality of 
decryption keys to generate a decrypted configuration bitstream; 

storing configuration data from the decrypted configuration bitstream in 
configuration memory of the PLD; 
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disabling readback of configuration data from the PLD after storing the 
configuration data in configuration memory; and 

disabling partial reconfiguration of the PLD in response to decryption of the 
configuration bitstream. 

10. (withdrawn) The method of claim 9, further comprising accepting only a single 
write instruction in the configuration bitstream in response to a control portion of 
the configuration bitstream indicating decrypted configuration data. 

1 1 . (withdrawn) The method of claim 9, further comprising: 

disabling the readback of the configuration data in response to a first state 
of a security status signal indicating that the decryption keys are protected; and 

enabling the readback of the configuration data in response to a second 
state of the security status signal indicating that the decryption keys are 
unprotected. 

12. (withdrawn) The method of claim 1 1 , further comprising: 

establishing the security status signal in the first state prior to loading the 
decryption keys into the PLD; and 

establishing the security status signal in the second state after loading the 
decryption keys into the PLD and before the receiving of the encrypted bitstream. 

13. (withdrawn) An apparatus for configuring a programmable logic device (PLD), 
comprising: 

means for storing a plurality of decryption keys in storage elements of the 

PLD; 

means for receiving a configuration bitstream at the PLD, wherein the 
configuration bitstream includes control data and configuration data and at least 
the configuration data is encrypted; 

means for decrypting the configuration bitstream in the PLD using the 
plurality of decryption keys to generate a decrypted configuration bitstream; 
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means for storing configuration data from the decrypted configuration 
bitstream in configuration memory of the PLD; 

means for disabling readback of configuration data from the PLD after 
storing the configuration data in configuration memory; and 

means for disabling partial reconfiguration of the PLD in response to 
decryption of the configuration bitstream. 

14. (withdrawn) A programmable logic device (PLD), comprising: 

a configuration memory; 

programmable logic circuitry coupled to the configuration memory; 

a key management circuit adapted for storage of a plurality of keys; 

a configuration circuit coupled to the configuration memory and to the 
plurality of storage elements, the configuration circuit adapted to configure the 
configuration memory with an input configuration bitstream, and to disable partial 
reconfiguration of the PLD and disable readback of configuration data from the 
PLD responsive to input of an encrypted configuration bitstream, decryption of the 
encrypted configuration bitstream, and configuration with the decrypted 
configuration bitstream; and 

a decryptor coupled to the configuration circuit and to the plurality of 
storage elements, the decryptor configured to decrypt, responsive to the 
configuration circuit, an input configuration bitstream using a plurality of decryption 
keys stored in the plurality of storage elements. 

15. (withdrawn) The PLD of claim 14, further comprising: 

wherein the key management circuit is adapted to generate, responsive to 
an input instruction, a security status signal having a state that indicates whether 
the decryption keys are protected; and 

wherein the configuration circuit is further adapted to disable the readback 
of the configuration data in response to a first state of the security status signal 
and enable the readback of the configuration data in response to a second state of 
the security status signal. 
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16. (withdrawn) The PLD of claim 15, wherein the PLD has a boundary scan port, 
and the input instruction is input via a boundary scan port. 
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